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Executive Summary 

Dominion Voting Systems, Inc., (DVS) submitted an application requesting Florida voting system 
certification of Democracy Suite Release 4.14.37, Version 2. Previous releases of the Democracy Suite 
voting system have been certified in Florida, the latest being Democracy Suite Release 4.14.37, Version 1 
(certified February 15, 2016). 

The Democracy Suite voting system is a paper-based voting system that complies with the Help America 
Vote Act (HAVA)^ provisions for accessibility voting. The latest voting system version consists of an election 
management system (EMS); two types of optical scan precinct count tabulators—the ImageCast Precinct 
(ICP) and the ImageCast Evolution (ICE); and a digital scan central count tabulator, the ImageCast Central 
(ICC). 

The ICC software controls various makes and models of scanners that function as central count tabulators. 
This certification effort adds an additional brand of scanner, the DRS PhotoScribe, to the Democracy Suite 
Release 4.14.37, Version 2 ICC equipment list. The PhotoScribe brand tabulator is currently certified with 
earlier releases of Democracy Suite—specifically, the Democracy Suite Release 4.14.17, Versions 1, 2, and 
3. 

The Bureau of Voting Systems Certification (BVSC) conducted the certification qualification testing in two 
phases. Phase I consisted of a physical audit to verify the setup configuration of the EMS (which has not 
been modified since Release 4.14.37, Version 1), the restoration of elections, and a functional audit. In 
this phase, the bureau also conducted mock elections and all election cycle events for the tabulator under 
test, as well as other tests to verify continued compliance with the Florida Voting System Standards 
(FVSS)^ Florida statutes and rules, and HAVA. In Phase II, BVSC conducted a mass ballot count test on the 
PhotoScribe brand of ICC central count tabulator. 

The qualification test results affirm that Democracy Suite Release 4.14.37, Version 2 met applicable 
requirements of the Florida Voting Systems Standards, the Florida Statutes and rules, and HAVA for 
usability and accessibility. BVSC, therefore, recommends certification of the referenced voting system. 
However, BVSC will not recommend the approval of any future release of this voting system unless the 
issues in the Continuous Improvements/Recommendations section of this report are addressed or are no 
longer an issue. 


1 52 U.S.C. § 20901 - 52 U.S.C. § 21145. 

^ DS-DE 101 (Rule lS-5.001, Florida Administrative Code) 
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Introduction 

Dominion Voting Systems, Inc., (DVS) submitted an application requesting Florida voting system 
certification of Democracy Suite Release 4.14.37, Version 2. The new release for which DVS is seeking 
certification adds a DRS brand scanner, the DRS PhotoScribe, to the current lineup of central count 
tabulators available in this release. 

The Democracy Suite voting system is a paper-based voting system that complies with HAVA provisions 
for accessibility voting. The voting system consists of an election management system (EMS); two types 
of optical scan precinct count tabulators—the ImageCast Precinct (ICP) and the ImageCast Evolution (ICE); 
and a digital scan central count tabulator, the ImageCast Central (ICC). 

The ICC software controls various makes and models of scanners that function as central count tabulators. 
This certification campaign adds the DRS brand scanner, the PhotoScribe, to the list of Canon brand 
scanners already certified for use with the voting system. 

BVSC conducted the certification qualification testing in two phases from October to December, 2019. 
Phase I consisted of a physical audit to verify the setup configuration of the EMS, the restoration of 
presidential preference primary, general and primary elections with their required media, and a functional 
audit. Phase I also comprised the conduct of mock elections and all election cycle events on the tabulator 
under test, including loading the tabulators with the requisite media, opening polls activities and reports, 
feeding ballots, closing polls activities and reports, and election night and post-election reporting. BVSC 
conducted regression tests to verify continued operability of the voting system. In Phase II, BVSC 
conducted a mass ballot count, a required test for the introduction of a tabulator to a Florida-certified 
voting system. 


Background 

The DRS PhotoScribe central count scanner is certified as part of the previous release of Democracy Suite, 
Release 4.14.17 (first version certified August 14, 2013). With this application, the vendor seeks to add 
the PhotoScribe scanner to the existing Democracy Suite, Release 4.14.37, Version 1 voting system 
(certified February 15, 2016). If approved, the voting system would become Democracy Suite, Release 
4.14.37, Version 2. There are no changes to the hardware, firmware, or software on the PhotoScribe 
scanner with this application for certification. 

Testing for Democracy Suite Release 4.14.37, Version 2 occurred at the Leon County Supervisor of 
Elections office in Tallahassee, Florida. 


System Overview 

The DVS Democracy Suite voting system election management system consists of the following software 
applications: 

• Application Server (APPS) - a server application for executing processes such as rendering 
ballots, generating audio files and election files, etc. 

• Audio Studio (AS) - a client application used to record audio files. 


5 





Florida Department of State 
Division of Elections 


Voting System Qualification Test Report 
DVS Democracy Suite, Release 4.14.37, Version 2 


• Data Center Manager (DCM) - a server application used in the back-end data center 
configuration. 

• EMS Database Server - A server side repository of the election project database, which 
includes pre-voting and post-voting data. 

• Election Data Translator (EDT) - an end-user application used to export election data from an 
election project and import election data into the election project. 

• Election Event Designer (EED) - a client application that integrates definition functionality 
together with ballot styling capabilities and represents a main pre-voting phase end-user 
application. 

• File System Service (FSS) - a Windows service application that helps read and write files on 
memory cards. 

• Results Tally and Reporting (RTR) - a client application used for integrating election results 
acquisition, validation, tabulation, and reporting. 


Democracy Suite uses the following scanning and tabulating devices and ADA voting device: 




ImageCast Precinct (ICP) tabulator is an optical 
scanner with ballot review. The ICP is attached on 
a ballot box (Figure 1, ICP only). 



Figure 1. ImageCast Precinct tabulator (ICP) 
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• ImageCast Evolution (ICE) is a precinct-level optical scanner, with ballot marking capability, 
audio voting using the Audio Tactile Interface (ATI), and a tabulator connected to a ballot box. 



Audio accessible voting may be accomplished on the ICE via 
the main monitor, as shown in Figure 2, or through an external, 
or "dual," monitor attached to the main unit (Figure 3). The 
dual monitor setup (ICE-Dual) allows an accessible voting 
session to occur while the unit is in standard operating mode 
and scanning paper ballots. 


Figure 2. ImageCast Evolution (ICE) with ballot box 


Figure 3. ICE with external, "dual" monitor 


• The central count scanners are the ImageCast Central (ICC) tabulators (Figures 4 and 5). These 
systems use commercial-off-the-shelf (COTS) hardware with Dominion software. The Canon 
brand scanners were certified with Democracy Suite Release 4.14.37, Version 1. This 
application for certification includes adding the DRS PhotoScribe brand scanners (Figure 5). 



Figure 4. ImageCast Central tabulator (ICC) (model Canon DR-XIOC shown) 
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Figure 5. ImageCast Central tabulator (ICC) (model DRS PhotoScribe shown). 


Components Under Review 

The test objective was to verify that the voting system meets the requirements of the applicable Florida 
statutes, standards, and federal laws. 

Since this release is an upgraded version of a certified release of the Democracy Suite voting system, BVSC 
performed a limited FVSS qualification examination. In particular, BVSC reviewed the DRS PhotoScribe 
brand central count scanners of the that were added to this voting system. 


Conduct of Tests / Findings 

The FVSS qualification examination encompassed a physical and functional audit, as well as additional 
tests to verify continued compliance with standards for election cycle events with the introduction of a 
new tabulator. In addition, BVSC conducted a mass ballot count test on the DRS PhotoScribe brand central 
count tabulator. 


Systems Setup & Configuration 

BVSC set up the voting system and verified that the configurations of the system, as outlined in the 
submitted technical data package (TDP) documentation, corresponded with the actual system setup. 

Findings: 

After all materials were received, technical issues were resolved, and the vendor clarified its 
documentation. BVSC found no discrepancies with the setup of the Democracy Suite voting system 
configurations. 
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Physical Audit 

BVSC conducted a physical audit to verify that the voting system matched the specifications described in 
the application and theTDP documentation. 

Findings: 

BVSC found no discrepancies between the voting system and the vendor's specifications in the 
certification application and TDP. 


Functional System Audit 

BVSC conducted a functional system audit on the unit under test (PhotoScribe scanner) to verify that all 
components of the unit operate as described in the TDP. 

Import of Election Definitions 

BVSC restored existing election definitions for a general election, a presidential preference primary (PPP) 
election, and a primary election. 

Election Management System - Administrative Reports 

Because there were no changes to the Democracy Suite 4.14.37, Version 2 election management system 
software, BVSC generated only the reports needed to verify test activities. In doing so, staff was able to 
recreate a known issue with the Statement of Votes Cast report (a report that shows precinct-level results 
for each candidate). 

Findings: 

The Statement of Votes Cast (SOVC) report contains extraneous data fields that could be confusing to 
individuals seeking to interpret report data. Below is an excerpt of a SOVC report (Figure 6). Election 
results are reported accurately for candidates and precincts, as expected. However, the "cumulative" 
data rows highlighted in blue are meaningless and unnecessary and the "County-Total" row is redundant, 
containing data that is already displayed in another report line. 
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Figure 6. Excerpt from the Statement of Votes Cast Report 


Voting Equipment Menus - Administrative and Diagnostic Reports 

BVSC performed a functional audit by testing all available menu options and administrative reports as well 
as systems functions in the course of testing. 

Findings: 

The system performed as indicated in the vendor's TDP and in accordance with the FVSS, and applicable 
Florida statutes, and administrative rules. 

Mock Elections Testing 

BVSC conducted mock elections as regression testing on the voting system. The mock elections 
incorporated single- and multiple-card ballots of varying ballot lengths (11-inch to 18-inch) for three 
election types: a primary, a PPP, and a general. The tests included both hand marked and machine marked 
ballots, pre-printed and on-demand ballots. BVSC simulated elections using an ICE precinct tabulator and 
both types of central count scanners, including an ICC Canon and all models of the ICC PhotoScribes, from 
initial preparations (pre-election activities) through voting (election activities), election night and precinct 
level reporting (post-election and reporting activities). BVSC compared election results to pre-determined 
results. 

Findings: 

The system performed as indicated in the vendor's TDP and in accordance with the FVSS, applicable 
Florida statutes, and administrative rules. BVSC did, however, observe an anomaly in the Democracy Suite 
4.14.37, Version 1 and 2 testing where contest titles on the precinct tabulator tapes for both the ICE and 
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ICP. The special character (hyphen) does not display correctly on the tapes (see Figure 5). This issue 
appears to be isolated only to the contest titles and only on the paper tapes (zero and results tapes). 
Furthermore, this issue does not affect the operation of the precinct tabulators or the scanning and 
tabulation of votes. BVSC determined that this issue is of low impact and severity; however, BVSC will 
require the vendor to correct this issue before any future releases of this voting system will be considered 
for certification. 


Write-in 
Total Uates 
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Write-in: 
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Figure 7. Special character display anomaly on precinct tapes 


Pre-Election Activities 

Pre-election activities included coding or verifying the coding of the election, preparing the election 
media, preparing the ballot test decks (unless already prepared by the vendor), preparing and validating 
the expected results (unless already prepared by the vendor), and preparing the voting equipment. The 
primary election definition included a universal primary contest (UPC). 

Election Activities 

Election activities included opening polls, casting ballots using test decks (including hand marked ballots 
and ballots marked using the ICE), and closing polls. 

Election Reporting 

Testing included uploading and verifying election results in the EMS by election group (vote-by-mail, early 
voting. Election Day, and provisional voting). BVSC uploaded results directly for the primary election and 
for the general election. Results were compared against expected results. 

Post-Election Activities 

Post-election activities included generating reports. 
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Mass Ballot Count 

The re-introduction of the DRS brand central count tabulator to the certified voting system necessitated 
a mass ballot count. 

Central Count Scanner [ICC] - DRS brand 

BVSC conducted a mass ballot count on the DRS (PhotoScribe) brand of scanners. To reach the 192,000 
minimum ballot requirement, BVSC used a test deck of pre-marked ballots supplied by the vendor. The 
pre-audited ballots, in varying lengths, were printed on 80-lb. conventional stock, as per the TDP. The test 
deck included easily verifiable vote patterns as well as overvotes and blank ballots. A set of predetermined 
results was also supplied and compared to the election results that were accumulated in the reporting 
application (RTR). 

BVSC used three (3) models of the PhotoScribe for the mass ballot count: PS900, PS960-Model B, and two 
PS976 scanners. 

Specific details follow: 

Table 1. Mass Ballot Count Details for DRS PhotoScribe Central Count Scanners 


Election definition used: 

Miami-Dade County 2014 Primary Election 

Ballot length: 

Varies 

Number of scanner units used: 

4 

Number of test decks: 

61 

Number of runs per test deck: 

10 

Number of ballots per deck: 

Varies 

Number of cards per ballot: 

Varies 

Total number of ballots cast: 

192,040 

Total number of vote targets: 

1,326,800 


Findings: 

The DRS PhotoScribe brand scanners under test met the acceptance criteria for the central count scanner 
mass ballot count as shown below: 
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Table 2. Acceptance Criteria for DRS PhotoScribe Brand Scanners 


DRS PhotoScribe Brand Scanners Mass Ballot Count - Acceptance Criteria 

Expected 

Accepted 

Did the memory registers overflow? 

No 


Did the public counters increment appropriately? 

Yes 


Did the tabulated results agree with predetermined vote totals? 

Yes 


Number of errors (must not exceed 1 in 1,000,000 vote targets). An error 
is defined as a target scan that produces a result other than the expected 
result. 

< I/IM vote 
targets 


Number of multiple feeds (must not exceed 1 in 5,000 ballots). A multiple 
feed occurs when the machine pulls multiple ballots and does not "catch" 
the error. 

< 1/5K ballots 


Number of incorrect rejections of ballots (must not exceed 3%) 

< 3% total ballots 



Additional Testing 

In addition to mock elections and mass ballot counts, BVSC conducted tests to verify continued 
compliance with FVSS, applicable Florida statutes and administrative rules, and HAVA, as well as to 
observe specific features and functions of the voting system. 


Contest Recounts 

BVSC conducted recount testing to verify compliance with sections 102.141(7) and 102.166(2), F.S., and 
the FVSS. BVSC selected three countywide races and two district-wide races in the general election. The 
recount was conducted on the DRS PhotoScribe central count scanners. Per the TDP instructions, BVSC 
suppressed non-recount races in the EMS results software. 

Findings: 

BVSC found that the voting system complied with applicable statutes and standards. Democracy Suite 
allows the user to report results from only the affected races. Furthermore, the system permits a recount 
on more than one race at a time, as demonstrated by processing both the countywide race and district¬ 
wide race in one recount. The vendor's initial documentation provided inadequate instructions necessary 
to complete all activities required. However, when modified, more detailed, instructions were presented, 
the system functioned as expected. 


Folded Ballot 

Although Florida law and FVSS do not require this test, BVSC conducted a folded-ballot test to simulate 
vote-by-mail ballot processing. The objective was to observe the behavior of the DRS brand of ICC central 
count scanners when they scan folded ballots. 
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BVSC used a test deck comprised of elections with several ballot lengths (11-inch, 14-inch, 17-inch, and 
18-inch ballots)^. Each test deck included different fold types: Z-fold, C-fold, a fold through a vote target'*, 
and a fold through a write-in, up to the maximum number of folds allowed per ballot length^. 

BVSC cast ballots into the ICC scanners (DRS) and compared the results to expected results. 

Findings: 

The scanners accepted all ballots presented, and tabulated results matched expected results. 


Simulated System Failure / Recovery 

BVSC performed a catastrophic failure test on the PhotoScribe to observe how the scanner conducts a 
"graceful"® shutdown due to power loss, and whether it would retain the counts and votes after a 
shutdown. 

Findings: 

BVSC found that the PhotoScribe scanner retained the public count and protective count, and ballots cast 
tallied correctly. 


System Time & Date Changes 

BVSC examined the PhotoScribe's ability to automatically accommodate time and date changes such as 
the Daylight Saving Time observance and leap year calendar changes. 


Daylight Saving Time 

BVSC examined the PhotoScribe clock's ability to automatically advance or turn back one hour with the 
Daylight Saving Time change. DVS advised in a previous certification that the PhotoScribe's clock is 
designed to be manually adjusted by the election official; it does not automatically adjust for Daylight 
Saving Time changes. 

Findings: 

BVSC found that the PhotoScribes did not consistently retain the updated time as expected. To ensure 
that counties' reports reflect the correct date and time, as the vendor indicated in a previous certification, 
counties should check the equipment date/time for accuracy before conducting any activities on the 
PhotoScribe scanners. 


^ According to the vendor's documentation, the DRS PhotoScribe brand scanners have a maximum ballot 
length of 18 inches. Other scanners in this voting system are able to handle longer ballots. 

Folds through a vote target are outside the ballot printing specification as outlined in the vendor's 
documentation. See Dominion Voting Systems ImageCast Printing Specification, Version 4.14.DS-FL::29 (July 7, 
2015), p. 11. 

® Dominion Voting Systems ImageCast Printing Specification, Version 4.14.DS-FL::29 (July 7, 2015), p. 11. 

® A "graceful" shutdown is an industry term meaning the unit is turned off by software function and the 
operating system is allowed to perform its tasks of safely shutting down processes and closing connections. 
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Leap Year 

BVSC examined whether the PhotoScribe correctly handled February 29 during leap years and non-leap 
years. 

Findings: 

BVSC found the ICP operated as expected. 


Infrared (IR) Security Sensor 

The infrared (IR) paper sensor is a security feature which, when enabled for an election on the ICE or ICP, 
allows only ballots printed on special IR-reactive ballot stock to be cast. The IR paper sensor contained in 
the ICE and ICP scanners detects paper infused with IR-reactive elements; when paper without the IR- 
reactive elements is inserted (as in the case of a fraudulent ballot), the tabulator rejects it. Counties have 
the option to enable this feature and print their ballots on the IR-reactive paper (IR security ballot stock), 
or use conventional ballot stock with the feature disabled. 

According to the TDP^. the DRS-brand (PhotoScribe) scanners cannot accept ballot stock heavier than 80- 
lb text stock, which is lower than the weight of IR security ballot paper (100-lb). The IR security ballot 
paper, therefore, is incompatible with DRS-brand scanners. 

Findings: 

The vendor's ballot printing specifications indicate that IR security ballot stock (100-lb text stock) is 
incompatible with DRS-brand scanners. Any county who chooses to use the IR security ballot stock should 
plan to exclude DRS-brand scanners when conducting central count and recount activities. The IR security 
ballot stock, which has been certified in Democracy Suite 4.14.37 Version 1, may continue to be used with 
the ICE, ICP, and Canon-brand scanners. 


User Security 

BVSC observed the voting system's behavior regarding user management and access control. BVSC 
observed no security-based anomalies during the course of any of the certification test activities. 


Source Code Review 

The source code did not change between Democracy Suite 4.14.37, Version 1 testing and Democracy Suite 
4.14.37, Version 2 testing. Therefore, a source code review was not required. 


ImageCast Printing Specification (07 July 2015). 
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Continuous Improvement / Recommendations 

There were no programmatic changes from the previously certified version of Democracy Suite 4.14.37, 
Version 1, which was certified in 2016. BVSC did not, therefore, add to the list of continuous improvement 
recommendations reported during that test effort. Since DVS has not yet addressed recommendations 
Democracy Suite 4.14.37, Version 1 testing, they are again listed below in this Democracy Suite 4.14.37, 
Version 2 test report. 

1. The precinct tabulator tape anomaly observed during Democracy Suite 4.14.37, Version 1 testing 
should be addressed in the next release of the voting system. This issue where the zero tapes and 
results tapes of the precinct scanners do not correctly display the special character (hyphen) 
affects only the paper tapes and not the operability or tabulating ability of the scanners; 
therefore, the anomaly does not preclude this version of the Democracy Suite voting system from 
recommendation for certification. However, any future certification for the Democracy Suite 
voting system, if granted, will be conditioned upon the vendor correcting this display issue. 

2. The vendor's remedy of the ICP's unexpected shutdown issue during Democracy Suite 4.14.37, 
Version 1 testing was to disable the audit mark feature on the ICP. The audit mark feature is not 
required by the Florida Statutes, rules, or FVSS. If any future release of the Democracy Suite voting 
system continues to incorporate the audit mark, DVS will be required to leave the audit mark 
disabled or, if enabled, the certification of such a system will be conditioned upon DVS correcting 
the shutdown issue. 

3. Statement of Votes Cast Report - This report contains extraneous data fields that could be 
confusing to individuals seeking to interpret report data. Details of the report's deficiencies are 
documented in the body of this report (see page 8). The Statement of Votes Cast Report should 
be revised to include only data that is needed to convey the votes cast in a given election. 


Conclusion 

Qualification test results affirm that Democracy Suite Release 4.14.37, Version 2 met applicable 
requirements of the Florida Voting Systems Standards, the Florida Statutes and rules, and the Help 
America Vote Act (HAVA) for usability and accessibility. The Florida Division of Elections, Bureau of Voting 
Systems Certification, therefore, recommends certification of the referenced voting system. However, 
BVSC does not recommend the approval of any future release of this voting system unless the issues in 
the Continuous Improvements/Recommendations section of this report are addressed or are no longer 
an issue. 
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Acronyms 


ADA 

Americans with Disabilities 

AS 

Audio Studio 

ATI 

Audio Tactile Interface 

BVSC 

Bureau of Voting Systems Certification 

COTS 

Commercial, off-the-shelf 

DVS 

Dominion Voting Systems, Inc. 

EAC 

U.S. Elections Assistance Commission 

EED 

Election Event Designer 

EMS 

Election Management System 

FVSS 

Florida Voting Systems Standards 

HAVA 

Help America Vote Act 

ICC 

ImageCast Central Count Tabulator 

ICE 

ImageCast Evolution Precinct Count / ADA Tabulator 

ICP 

ImageCast Precinct Count Tabulator 

LAN 

Local Area Network 

PPP 

Presidential Preference Primary 

RTR 

Results Tally and Reporting 

TDP 

Technical Data Package 

UPC 

Universal Primary Contest 

UUT 

Unit Under Test 

VVSG 

Voluntary Voting System Guidelines 
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Component Version List 

The component version list describes in detail the components of the voting system. 

[Redacted pursuant to section 282.318, Florida Statutes, and to the U.S. Department of Homeland 
Security's designation of elections as a critical infrastructure.] 
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